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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 

WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a}. In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
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1 !)□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
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DETAILED ACTION 

" Applicant's amendment filed on July 30, 2007 has been entered. Applicant has 
amended claims 1, 2, 9, 21, 22, canceled claims 3-8, 10-20 and 23-26 and added 
new claims 27-30. Currently Claims 1. 2, 9. 21, 22, 27, 28, 29 and 30 are 
pending in this application. 

" Examiner acknowledges receiving a replacement sheets for drawings (Figures 4- 
7) with a revised Figures 4-7. The drawings were received on 07/30/2007. These 
drawings are acceptable. As a result, drawing objection is withdrawn. 

■ Claim objection on claim 5 is withdrawn because applicant has canceled the 
claim, rendering the objection moot. 

Claim Objections 

1 . Claims 1 and 21 , are objected to because of the following informalities: 

Regarding Claims 1 and 21, amended claims recite various new limitations 
including "the web page object to be rendered and displayed... a verification service that 
hosts the web page object... wherein the visitor is not required... wherein the verification 
service causes the contents of the web page object to be automatically rendered and 
displayed in accordance with its prior determination... in a second verification operation 
prior to the visitor's access request..., it causes the web page object to have different 
second contents..., wherein the first and second verification operations to determine the 
on-line service's security status..., wherein when the verification service causes the web 
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page object to have... appears invisible to tlie visitor after it is rendered by the visitor's 
browser." are not clearly defined/supported in the original disclosure. 

Applicant is required to point out where these amended claim limitations are in 
the original disclosure and please note that no new matter should be added in the 
ordinal disclosure in addressing the claim objections. 

Any claim not specifically addressed, above, is being objected as incorporating 
the deficiencies of a claim upon which it depends. 



Double Patenting 

2. The nonstatutory double patenting rejection is based on a judicially created 
doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the 
unjustified or Improper timewise extension of the "right to exclude" granted by a patent 
and to prevent possible harassment by multiple assignees. A nonstatutory 
obviousness-type double patenting rejection is appropriate where the conflicting claims 
are not identical, but at least one examined application claim is not patentably distinct 
from the reference claim(s) because the examined application claim is either anticipated 
by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 
F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 
USPQ2d 2010 (Fed. Cir. 1993); In re Long!, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 
1985); In re Van Omum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 
F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 
USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) 
may be used to overcome an actual or provisional rejection based on a nonstatutory 
double patenting ground provided the conflicting application or patent either is shown to 
be commonly owned with this application, or claims an invention made as a result of 
activities undertaken within the scope of a joint research agreement. 

Effective January 1 , 1 994, a registered attorney or agent of record may sign a 
terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 
37 CFR 3.73(b). 

Claims 1,2,9,21, 27, 28, 29 and 30 are provisionally rejected on the ground of 
nonstatutory obviousness-type double patenting as being unpatentable over claims 1 . 2, 
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9, 39 and 40 of copending Application No. 10/1 13875 in view of Khaishgi et al. (US 
6,658,394 B1 ), hereinafter Khaishgi. 

Regarding Claims 1, the only difference between claim 1 of the '875 patent 
application and claim 1 of the '875 patent application is that the pending application '875 
has an additional limitation of "wherein when the verification service cause the web 
page object to have at least one of the first and second contents, the web page object 
appears invisible to the visitor after it is rendered by the visitor's browser". However, 
Khaishgi discloses this additional limitation (at Column 4, lines 54-57, "In one 
configuration, seal issuer 8 generated a media object having a transparent image when 
the corresponding merchant 4 loses its certification status. In this manner, the seal 
"disappears" from the merchant web site"). Therefore, it would have been obvious at the 
time the invention was hiade to one of ordinary skill in the art to modify claim 1 of '855 
to have the web page object appear invisible to the visitor so that "the seal "disappears" 
from the merchant web site" (Khaishgi, Column 4, lines 54-57). This act illustrate that 
the seal is no more verified or the merchant failed to verity itself during re-verification 
process. 

Claim 21 has identical limitation of claim 1 with the different statutory category 
(method steps). Therefore, it is also rejected under same rationale. 
Claims 2 and 27, are identical in scope to claim 2 of '875. 
Claims 9 and 28, are identical in scope to claim 9 of '875. 
Claim 29 is identical in scope to claim 39 (with just a different statutory category). 
Claim 30 is identical in scope to claim 30 (with just a different statutory category). 
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The mapping of tlie rejected claims in the present application to the copending 
application is follows: 

Present Application (1 0/674878) Co-Pending Application (1 0/1 1 3875) 



1 


1 


2 


2 


9 


9 


21 


1 


27 


2 


28 


9 


29 


39 


30 


40 



This is a provisional obviousness-type double patenting rejection because the 
conflicting clainns have not in fact been patented. 

Claim Rejections - 35 USC § 102 
3. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(a) the invention was known or used by others in this country, or patented or described in a printed 
publication in this or a foreign country, before the invention thereof by the applicant for a patent. 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
states. 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
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granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

Claims 1 and 21 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Khalshqi et al. (US 6.658.394 B1). hereinafter Khaishgi. 

Regarding Claims 1 and 21 Khaistigi discloses an apparatus and corresponding 
method for providing a security status of an on-line service, comprising: 

a web page object (Column 1, lines 26-28, "electronic seals") that is 
automatically rendered by a browser when a visitor uses the browser (Fig. 5, Numerals 
52, 54, 56, and 58, and at Column 2, lines 34-44, "browser") to access one or more 
web pages of the on-line service (Fig. 1, Numeral 4, "Merchant") via a public network 
(Fig. 1, Numeral 12, "Network"); and 

a verification service (Fig. 2, Numeral 8, "Certification Service") that hosts the 
web page object (Fig. 2, Numeral 22, "Seal Servers") separately from the one or more 
web pages of the on-line service (Fig. 2, Numeral 4, Merchant's server(s) numeral 4 
are separate from the "Seal servers 22" of "Certification Service", also refer to 
Column 3, lines 14-25). and further controls contents of the web page object (Column 
3, lines 26-42), 

wherein the visitor is not required to take any action other then requesting access 
to the on-line service via the browser to receive the security status (Column 2, lines 66- 
67 and Column 3, lines 1-2, "Merchants 4 post their corresponding electronic 
seals on their web sites or in electronic mail messages (emails) in order to 
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increase the confidence of potential customers", Note: Since web-page of the 
merchant contains the link of the seal, the seal is generated and displayed on the web- 
page when client generates a request for a web-page from a merchant, client will only 
need to take further action (i.e. click on the seal) if client want "more information" about 
the seal and merchant, refer to Column 3,line 14-25) , and 

wherein the verification service causes the contents of the web page object to be 
automatically rendered and display in accordance with its prior detennination of a level 
of the security status (Column 4, lines 60-67 and Column 5, lines 1-7, "When user 6 
accesses a merchant 4, client device 10 is directed to retrieve a seal from seal 
servers 22. More specifically, seal servers 22 receive a request from computing 
device 10 that includes a unique identifier for one of the merchants and, 
therefore, uniquely identifies one of the media objects within seal repository 25 
(step 52). Seal servers 22 log the request by storing the IP address within request 
log 24 (step 54) and select the appropriate media object according to the unique 
identifier (step 56). "), such that when the verification service determines, in a first 
verification operation prior to the visitor's access request, that the on-line service has a 
first level of the security status, it causes the web page object to have first contents 
(Column 4, lines 60-67 and Column 5, lines 1-7, Seal sen/er provide the electronic 
seal corresponding to the merchant to the client), and when the verification service 
determines, in a second verification operation prior to the visitor's access request, that 
the on-line service has a different second level of the security status (Column 4, lines 
49-52, "Next, seal maintenance modules 27 periodically regenerate the media 
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objects in order to update the embedded information including the expiration 
date (Step 48).") , it causes the web page object to have different security status levels 
via the browser's automatic rendering of the prior-determined web page object contents 
when the visitor requests access to the on-line service (Column 4, lines 52-54, "For 
example, a new set of media object can be generated daily in order to facilitate 
detection of expired seals"), and 

wherein the first and second verification operations to determine the on-line 
service's security status and control the contents of the web page object are performed 
by the verification service prior to and completely independently from the visitor's 
request to access the on-line service, and independently from any action by the visitor 
and visitor's browser (Column 4, lines 28-57, Note: Both the seal generation and 
maintenance are done by certification sen/ice and these steps are done completely 
independently from the visitor's request to access the on-line se/v/ce, i.e. visitor's 
request to access the on-line service does not trigger initial seal request operation from 
merchant (fig.3) or the maintenance which can be done daily) , and 

wherein when the verification service causes the web page object to have at 
least one of the first and second contents, the web page object appears invisible to the 
visitor after it is rendered by the visitor's browser (Column 4, lines 54-57, "In one 
configuration, seal issuer 8 generated a media object having a transparent image 
when the corresponding merchant 4 loses its certification status. In this manner, 
the seal "disappears" from the merchant web site"). 
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Regarding Claim 22, the rejection of claim 21 is incorporated and Khaishgi 
further discloses wherein at least one of the first and second verification operations 
includes scanning the on-line service from a remote address on the networl< (Fig. 2, 
Numeral 8, and 4, Verification of Merchant 4 is done from the Certification Server 
which includes Theft Detection IModules 28, Certification Service 8 can be seen 
remotely located from Merchant 4). 

Regarding Claim 29, the rejection of claim 21 is incorporated and Khaishgi 
further discloses the web page object comprises an image and an associated URL 
(Column 3, lines 28-31, "Each media object contains media, such as image data, 
video data, and audio data, that merchant 4 presents as an electronic seal of 
certification." and also at Column 3, lines 58-67, URL for the seal). 

Regarding Claim 30, the rejection of claim 21 is incorporated and Khaishgi 
further discloses the web page object comprises a graphical file whose contents are 
periodically updated in accordance with a periodically determined security status level 
((Column 3, lines 28-31, "Each media object contains media, such as image data, 
video data, and audio data, that merchant 4 presents as an electronic seal of 
certification." and at Column 4, lines 49-57, "Next, seal maintenance modules 27 
periodically regenerate the media objects in order to update the embedded 
information including the expiration date (step 48). For example, a new set of 
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media objects can be generated daily in order to facilitate detection of expired 
seals.") 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth In section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 2. 9, 27. 28 are reiected under 35 U.S.C. 103(a) as being unpatentable 
over Khaishgj in view of Pham et aL (US 2003/0097591 AD. hereinafter Pham. 

Regarding Claims 2 and 27, rejections of claims 1 and 21 are incorporated and 
Khaishgi further discloses wherein the on-line service comprises devices and services 
(Fig. 1, Numeral 4, representing web-servers of Merchant 4) and verification service 
determines the security status level of the on-line service (Column 2, lines 44-46, 
"Seal issuer 8 verifies the credentials, policies or business practices of each 
Merchant 4 and issues a corresponding seal of certification to each merchant 4 
upon verification."). Even though Khaishgi discloses verification service determining 
the security status level of the on-line service by verifying the credentials, policies or 
business practices of each on-line service i.e. Merchant, however Khaishgi failed to 
discloses that the verification service determines the security status level of the on-line 
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service by evaluating a vulnerability scan of the devices and services comprising the on- 
line service. 

However, determining the security status level of the on-line service by 
evaluating a vulnerability scan of the devices and services of the on-line service is well 
known in the art of network security. Pham, in the same field of endeavor of network 
security discloses determining the security status level of the on-line service by 
evaluating a vulnerability scan of the devices and services of the on-line service (Fig. 

Therefore, it would have been obvious at the time the invention was made to one 
of ordinary skill in the art to include in the Certification Service of Khaishgi, a 
vulnerability scanner as taught by Pham to protect "computer users from Web sites 
hosting computer viruses and for protecting Web hosting systems from hosting Web 
pages that contains linl<s to computer viruses" (Pham, Paragraph 0005). 

Regarding Claims 9 and 28, rejections of claims 2 and 27 are incorporated and 
the combination of Khaishgi and Pham further discloses verification service periodically 
receives result of a new vulnerability scan of the devices and services comprising the 
on-line service and causes the contents of the web page object to be changed it a 
changed security status level is determined, thereby automatically providing the visitor 
with an updated security status (Pham, Paragraph 0042, "This provides the 
capability to monitor the progress of the Web crawler to ensure that all pending 
links are scanned, as well as providing the capability to periodically update scans 
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of sites that have already been scanned." and Khaishgi, Column 4, lines 49-57, 
"Next, seal maintenance modules 27 periodically regenerate the media objects in 
order to update the embedded information including the expiration date (step 48). 
For example, a new set of media objects can be generated daily in order to 
facilitate detection of expired seals.") 

Response to Amendment 

5. Applicant has amended independent claims 1 and 21, which necessitated new 
grounds of rejection. See rejection above. 

Conclusion 

6. Applicant's amendment necessitated the new ground(s) of rejection presented in 
this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP 

§ 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 
CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
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the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Yogesh Paliwal whose telephone number is (571) 270- 
1807. The examiner can normally be reached on M-F: 7:30 AM - 5:00 PM EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on (571) 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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